CVE-2026-111714lowCWE-1333

CVE-2026-111714: low-severity vulnerability in AmauriC tarteaucitron.js

tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

Published · Updated

Follow this CVE+ Monitor tarteaucitron.js

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.2%
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
AmauriC · tarteaucitron.js
Related CVEs — AmauriC tarteaucitron.js

In the same product, most dangerous first.

CVE-2025-31476MEDIUMtarteaucitron.js allows url scheme injection via unfiltered inputsEPSS 0.4%CVE-2026-49977MEDIUMtarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookiesEPSS 0.4%CVE-2025-31475MEDIUMtarteaucitron.js allows prototype pollution via custom text injectionEPSS 0.4%CVE-2025-31138MEDIUMtarteaucitron.js allows UI manipulation via unrestricted CSS injectionEPSS 0.3%CVE-2025-48939MEDIUMtarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptEPSS 0.2%CVE-2026-111713MEDIUMtarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation MismatchEPSS 0.2%